What is the CVSS score of CVE-2026-10685?

CVE-2026-10685 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Zephyr RTOS are affected by CVE-2026-10685?

Zephyr RTOS devices with active Bluetooth GATT connections face a use-after-free vulnerability (CVE-2026-10685) that allows adjacent Bluetooth peers to crash the device or redirect its execution.. A patch is available.

How to fix or mitigate CVE-2026-10685?

Within 24 hours, identify all systems and deployed devices running Zephyr RTOS with Bluetooth GATT client functionality, and assess exposure by reviewing network segmentation and Bluetooth pairing policies. Within 7 days, check the official Zephyr project advisory for the specific tagged release version containing the fix, then create an update plan for affected devices. Within 30 days, patch all vulnerable Zephyr instances to that confirmed release version and test Bluetooth GATT functionality in staging before production rollout.

Zephyr RTOS CVE-2026-10685

EUVD-2026-51554 HIGH

Use After Free (CWE-416)

2026-07-31 zephyr

Use After Free Denial Of Service Buffer Overflow Memory Corruption Zephyr

7.6

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

7.6 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

7.6 HIGH

Bluetooth adjacency bounds reach to radio range; attacker needs no credentials as peer GATT server; A:H reflects reliable crash from freed function-pointer dereference.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 15:21 vuln.today

Analysis Generated

Jul 31, 2026 - 15:21 vuln.today

CVE Published

Jul 31, 2026 - 14:41 cve.org

HIGH 7.6

DescriptionCVE.org

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0).

Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer.

The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp).

For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.

AnalysisAI

Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.

Technical ContextAI

The vulnerability resides in subsys/bluetooth/host/gatt.c within the Zephyr RTOS Bluetooth Host stack (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). GATT (Generic Attribute Profile) runs over ATT (Attribute Protocol) on BLE and uses Client Characteristic Configuration (CCC) descriptors to establish notification/indication subscriptions. The bt_gatt_subscribe_params struct carries two application-supplied callbacks - notify() and subscribe() - and its lifetime is governed by API contract: a notify(conn, params, NULL, 0) call is the documented signal that the subscription has ended and the struct may be freed or reused. The original code in the error branch (att_error_rsp → att_handle_rsp → gatt_write_ccc_rsp) invoked notify(NULL) first, then subscribe(); any application conforming to the documented contract could free the struct inside the notify handler, causing the subsequent subscribe() call through the freed params->subscribe function pointer to constitute a CWE-416 use-after-free. The fix (commit c7292f20223637232b6f962141725611a38f6a52) reorders both the error path and the unsubscribe path so subscribe() is always called before notify(NULL).

RemediationAI

Apply the upstream fix from commit c7292f20223637232b6f962141725611a38f6a52 (https://github.com/zephyrproject-rtos/zephyr/commit/c7292f20223637232b6f962141725611a38f6a52), which reorders both the ATT error path and the unsubscribe path in gatt_write_ccc_rsp() so that params->subscribe() is always invoked before params->notify(NULL). Monitor the GitHub security advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-29xh-jm2m-4qvx for an official tagged release containing this fix, as a specific patched version number was not confirmed from available data. As a compensating control where patching is not immediately feasible, application developers should defer freeing or recycling bt_gatt_subscribe_params to a workqueue or system thread context rather than directly inside the notify termination callback; this breaks the use-after-free chain without requiring a kernel patch but adds scheduling latency to subscription teardown. Restricting which Bluetooth peers the device will connect to via allowlisting (if supported by the platform) reduces exposure by preventing arbitrary adjacent attackers from acting as GATT server peers.